BAT.Mumu.A.Worm

BAT.Mumu.A.Worm is a collection of batch files and utilities, as well as a hacktool named Hacktool.Hacline. It is possible that the names and functions of the files may change. The information discussed in this writeup is based on the samples that Security Response has reviewed.

This worm will spread using administrative shares on Windows NT, 2000, and XP systems. The worm will execute on the Windows 95/98/Me systems; however, it does not harm these systems.

NOTE: The detection of BAT.Mumu.A.Worm was updated in the June 18, 2003 virus definitions to account for some samples that contained minor variations to the originally discovered files.

Protection

• Initial Rapid Release version June 3, 2003
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version June 3, 2003
• Latest Daily Certified version January 20, 2009 revision 048
• Initial Weekly Certified release date June 3, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: Medium